C:\Users\Administrator\Documents\Work\DemProject\Output\Loader\Release\Loader_Release_Win32.pdb
Static task
static1
Behavioral task
behavioral1
Sample
57cd23966336cf1e69557f61f2c9eab3577aa18d4f86346649dd580772b20122.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
57cd23966336cf1e69557f61f2c9eab3577aa18d4f86346649dd580772b20122.exe
Resource
win10v2004-20240226-en
General
-
Target
15737076299.zip
-
Size
125KB
-
MD5
85448b4d002f2b359a97c1b8d6f13707
-
SHA1
0bcedd8c87c370045d8e6dee306a10f2b8e970b5
-
SHA256
c7ed1e2b64da5e428cc64d15f6175d3c743fa433f725e6336db8278d4f6cbbc2
-
SHA512
de0403d2b7f1d2aeaf6cec1bd95c0be73d625937bef80531d9057229d7bf4dad7db8db4ccf031f83e3bc4dca1fda1c9437ce2dde2072e22c9417a15006971307
-
SSDEEP
3072:5s/gQavMYDN55r4tWPZcqWBjXJZeqlExSjC4hjo:iYQuN556ceqIZHq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/57cd23966336cf1e69557f61f2c9eab3577aa18d4f86346649dd580772b20122
Files
-
15737076299.zip.zip
Password: infected
-
57cd23966336cf1e69557f61f2c9eab3577aa18d4f86346649dd580772b20122.exe windows:5 windows x86 arch:x86
99ffa1fe3b8cdde3dbe015b777fc147a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
CloseHandle
Sleep
WaitForSingleObject
TerminateThread
CreateDirectoryA
CreateThread
CreateFileA
GetCurrentProcess
WriteFile
OpenProcess
GetFileAttributesA
CreateProcessA
TerminateProcess
MultiByteToWideChar
SetCurrentDirectoryA
CopyFileA
Process32FirstW
IsWow64Process
GetModuleFileNameA
Process32NextW
CreateFileMappingA
CreateToolhelp32Snapshot
DeleteFileA
SetEndOfFile
CreateFileW
ReadConsoleW
ReadFile
WriteConsoleW
FlushFileBuffers
SetStdHandle
SetEnvironmentVariableA
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
OutputDebugStringW
GetLastError
UnmapViewOfFile
CreateMutexA
MapViewOfFile
LoadLibraryExW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
IsDebuggerPresent
IsProcessorFeaturePresent
HeapReAlloc
EncodePointer
DecodePointer
GetCommandLineW
GetProcessHeap
EnterCriticalSection
LeaveCriticalSection
RaiseException
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
GetCurrentThreadId
ExitProcess
GetModuleHandleExW
GetProcAddress
AreFileApisANSI
WideCharToMultiByte
GetStdHandle
GetModuleFileNameW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
DeleteCriticalSection
HeapSize
RtlUnwind
GetFileType
QueryPerformanceCounter
GetCurrentProcessId
user32
SendMessageW
DispatchMessageW
DefWindowProcW
CreateWindowExW
LoadStringW
LoadIconW
RegisterClassExW
LoadAcceleratorsW
TranslateMessage
EndPaint
DestroyWindow
TranslateAcceleratorW
GetMessageW
PostQuitMessage
LoadCursorW
BeginPaint
advapi32
RegOpenKeyExA
RegSetValueExA
RegCloseKey
ws2_32
gethostbyname
closesocket
socket
recv
WSACleanup
htons
WSAStartup
connect
send
Exports
Exports
_cJSON_AddArrayToObject@8
_cJSON_AddBoolToObject@12
_cJSON_AddFalseToObject@8
_cJSON_AddItemReferenceToArray@8
_cJSON_AddItemReferenceToObject@12
_cJSON_AddItemToArray@8
_cJSON_AddItemToObject@12
_cJSON_AddItemToObjectCS@12
_cJSON_AddNullToObject@8
_cJSON_AddNumberToObject@16
_cJSON_AddObjectToObject@8
_cJSON_AddRawToObject@12
_cJSON_AddStringToObject@12
_cJSON_AddTrueToObject@8
_cJSON_Compare@12
_cJSON_CreateArray@0
_cJSON_CreateArrayReference@4
_cJSON_CreateBool@4
_cJSON_CreateDoubleArray@8
_cJSON_CreateFalse@0
_cJSON_CreateFloatArray@8
_cJSON_CreateIntArray@8
_cJSON_CreateNull@0
_cJSON_CreateNumber@8
_cJSON_CreateObject@0
_cJSON_CreateObjectReference@4
_cJSON_CreateRaw@4
_cJSON_CreateString@4
_cJSON_CreateStringArray@8
_cJSON_CreateStringReference@4
_cJSON_CreateTrue@0
_cJSON_Delete@4
_cJSON_DeleteItemFromArray@8
_cJSON_DeleteItemFromObject@8
_cJSON_DeleteItemFromObjectCaseSensitive@8
_cJSON_DetachItemFromArray@8
_cJSON_DetachItemFromObject@8
_cJSON_DetachItemFromObjectCaseSensitive@8
_cJSON_DetachItemViaPointer@8
_cJSON_Duplicate@8
_cJSON_GetArrayItem@8
_cJSON_GetArraySize@4
_cJSON_GetErrorPtr@0
_cJSON_GetNumberValue@4
_cJSON_GetObjectItem@8
_cJSON_GetObjectItemCaseSensitive@8
_cJSON_GetStringValue@4
_cJSON_HasObjectItem@8
_cJSON_InitHooks@4
_cJSON_InsertItemInArray@12
_cJSON_IsArray@4
_cJSON_IsBool@4
_cJSON_IsFalse@4
_cJSON_IsInvalid@4
_cJSON_IsNull@4
_cJSON_IsNumber@4
_cJSON_IsObject@4
_cJSON_IsRaw@4
_cJSON_IsString@4
_cJSON_IsTrue@4
_cJSON_Minify@4
_cJSON_Parse@4
_cJSON_ParseWithLength@8
_cJSON_ParseWithLengthOpts@16
_cJSON_ParseWithOpts@12
_cJSON_Print@4
_cJSON_PrintBuffered@12
_cJSON_PrintPreallocated@16
_cJSON_PrintUnformatted@4
_cJSON_ReplaceItemInArray@12
_cJSON_ReplaceItemInObject@12
_cJSON_ReplaceItemInObjectCaseSensitive@12
_cJSON_ReplaceItemViaPointer@12
_cJSON_SetNumberHelper@12
_cJSON_SetValuestring@8
_cJSON_Version@0
_cJSON_free@4
_cJSON_malloc@4
Sections
.text Size: 152KB - Virtual size: 152KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 41KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 92KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ